Example - 1

The following example demonstrates the weakness.

// // privileged code goes here, for example:// 
// // nothing to return// 
System.loadLibrary("awt");return null;public Object run() {}AccessController.doPrivileged(new PrivilegedAction() {

Example - 2

The following example demonstrates the weakness.

// // Do some important stuff// 
// // Do some non privileged stuff.// 
setuid(0);setuid(old_uid);

Example - 3

The following code calls chroot() to restrict the application to a subset of the filesystem below APP_HOME in order to prevent an attacker from using the program to gain unauthorized access to files located elsewhere. The code then opens a file specified by the user and processes the contents of the file.

chroot(APP_HOME);chdir("/");FILE* data = fopen(argv[1], "r+");...

Constraining the process inside the application's home directory before opening any files is a valuable security measure. However, the absence of a call to setuid() with some non-zero value means the application is continuing to operate with unnecessary root privileges. Any successful exploit carried out by an attacker against the application can now result in a privilege escalation attack because any malicious operations will be performed with the privileges of the superuser. If the application drops to the privilege level of a non-root user, the potential for damage is substantially reduced.